CVE-2024-49950

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. This use-after-free vulnerability in the l2cap_connect function could allow a local attacker with administrative privileges to cause a denial of service or potentially execute arbitrary code.

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Bluetooth service or prevent the bluetooth kernel module from loading. To disable the Bluetooth service, execute systemctl disable --now bluetooth.service. To prevent the module from loading, create a file /etc/modprobe.d/bluetooth-blacklist.conf with the content blacklist bluetooth and reboot the system. This will disable all Bluetooth functionality and may impact features relying on Bluetooth.